• 0 Posts
  • 7 Comments
Joined 2 years ago
cake
Cake day: August 16th, 2024

help-circle

  • Thats part of the problem though. Supposedly catfriend1 gave researchxxl their signing keys, and researchxxl used these on their new github account. No one was aware that catfriend1 was not maintaining the repo anymore until users saw unexpected/unannounced updates and looked into the matter. This sparked a short lived discussion on F-Droid forums about what should be done when maintainer transfers are handled poorly like this. F-Droid admins decided that it wasn’t that big of an issue, which is problematic… this supposedly happened between two people meeting each other online and discussing it with each other. But its possible that catfriend1 is being blackmailed or otherwise coerced into handing off this data. This type of credential attack could happen with a compromised machine, without the victim ever realizing it in time. The fact that F-Droid treats this so casually is upsetting. Signed developer certificates protect you from MITM attacks, it does not protect you from the sources themselves being compromised.


  • Years ago, official development of an android app of syncthing was abandoned by the official developers. Most android users migrated to an already existing fork by a github maintainer catfriend1.

    Catfriend1 unceremoniously disappeared, with their github repositories being taken over by a new user researchxxl. This was entirely unannounced and wasn’t really discovered until people with automatic updates enabled on *Obtanium noticed it.

    researchxxl is not a known community member, and is being very reclusive when interacting with the syncthing community. Their github account was made specifically for the repository transfer, and their method of handling existing credentials is suspicious; looking no different than a hostile take over.

    At this point in time, they are collaborating with Nexon, a user who worked with catfriend to publish syncthing fork builds to Google Play. They are more well known and trusted. If you can trust Nexon, and trust that end users in general are putting more scrutiny on the github source code after this whole situation, you can probably trust the recent releases for now.

    Sorry for any details I may have gotten wrong. AFAIK, no one has taken the time to document all the things that have gone down. I would have linked to such a document otherwise. A lot of the discussion on this is happening in separate discussion threads, one of them being researchxxl’s github issue page, which they are censoring/deleting discussions from with(till recently) no oversight.

    *Edit: this is also a poor summary. There is a lot of additional context that I don’t feel comfortable trying to encompass. Like why the official syncthing developers stopped their official android app, or catfriend1’s forum account coming back for a short time to try to explain their side of the story. Frankly, for how many people are using syncthing, I don’t think this story is getting enough attention.




  • Usually how these verification systems work is; if you cant verify, you don’t get to chat. Its supposed to lock out children from communicating with strangers online. There is no reason to verify children if the only people allowed to talk are verified adults.

    I don’t know what clown shoes system Roblox has decided to go with. Again, the article doesn’t seem to specify why they are collecting children data. If the idea is to age gate chat between player demographics, so that kids can talk to other kids… that seems like a wasted effort. Children are quite capable of abusing each other without any adults around. Age verification is not an alternative to moderation.

    And that’s without getting into “AI age verification is easily fooled”; kids and predators alike are going to get around the system if they bother looking into how to do so. Just as all the generations before them were constantly circumventing lazy tech solutions for blocking content when children are involved.


  • Age verification is already dystopian, but why do kids need to verify their age??? Wouldn’t the logical assumption be that if you can’t verify as an adult, that they would be underage and therefore be chat limited? What purpose is there to having photo verification that someone is a child? I figured it was a poorly written headline, but the article does seem to suggest they are pointlessly collecting data on children with no explanation.

    Also don’t appreciate this article acting like corporate monopolies should be more trusted with the surveillance state. It’s crazy seeing all news sites manufacturing consent for this shit so openly.